Wiz reports responding to AI-driven attacks across cloud estates

Wiz published an account on 19 October 2026 of what it describes as real AI-driven attacks against cloud environments, saying its Cloud Incident Response Team (CIRT) responded to intrusions that spanned cloud infrastructure, Kubernetes clusters, CI/CD pipelines and identity systems.

The company frames the activity in the title of its write-up as "loud, fast, and everywhere" — a description that points to attacks that generate a large volume of activity, move quickly, and touch several layers of a victim's estate rather than a single service. According to Wiz, the purpose of the post is to set out how these attacks behave in practice and how defenders can detect them.

The breadth matters because the four areas Wiz names sit at different points in a typical cloud stack. Cloud control planes govern the accounts and resources themselves. Kubernetes is the orchestration layer that schedules and runs containers. CI/CD — continuous integration and continuous delivery — is the automated pipeline that builds and ships code into production. Identity is the system of accounts, roles and permissions that ties the rest together. An intrusion that crosses all four is harder to scope and contain than one confined to a single workload, because evidence and controls are split across different teams and tools.

Wiz does not, in the material reviewed, name the victims, quantify the number of incidents, or attribute the activity to a particular group. The Agentic Times has not independently verified the company's account, and readers should treat the characterisation of the attacks as AI-driven as the vendor's own assessment of what it observed during its engagements.

For security teams, the operational point in Wiz's framing is about speed and signal. Attacks described as loud leave traces — unusual API calls, new identities, pipeline changes, container activity — but attacks described as fast compress the window in which those traces are useful. Detection that depends on daily log review or manual triage is a poor fit for an adversary operating at machine pace. Correlating signals across the cloud control plane, Kubernetes audit logs, build pipelines and identity providers, rather than monitoring each in isolation, is the kind of posture that a cross-layer intrusion demands.

The report adds to a growing body of vendor material arguing that attackers are now using automation and AI tooling in live intrusions rather than only in research settings. Wiz's contribution here is that it is reporting from incident response work, not from a laboratory demonstration. What the post does not establish is how far the AI component shaped the outcome of those intrusions, as opposed to simply accelerating steps attackers were already capable of taking by hand. That distinction will matter for anyone deciding how much of their detection budget to re-point at machine-speed activity.